High-degree compression functions on alternative models of elliptic curves and their applications

TL;DR

This paper develops high-degree compression functions for elliptic curve models using symmetries, introduces new functions, and analyzes their efficiency and applicability, especially in models with points of order 2, 3, and 4.

Contribution

It presents novel high-degree compression functions based on symmetries in alternative elliptic curve models and provides formulas and computational methods for their use.

Findings

New compression functions for specific elliptic curve models.

Differential addition and doubling formulas are derived for these functions.

Efficiency comparable to Montgomery curves is achieved under certain conditions.

Abstract

This paper presents method for obtaining high-degree compression functions using natural symmetries in a given model of an elliptic curve. Such symmetries may be found using symmetry of involution $[-1]$ and symmetry of translation morphism $\tau_T=P+T$, where $T$ is the $n$-torsion point which naturally belongs to the $E(\mathbb K)$ for a given elliptic curve model. We will study alternative models of elliptic curves with points of order $2$ and $4$, and specifically Huff's curves and the Hessian family of elliptic curves (like Hessian, twisted Hessian and generalized Hessian curves) with a point of order $3$. We bring up some known compression functions on those models and present new ones as well. For (almost) every presented compression function, differential addition and point doubling formulas are shown. As in the case of high-degree compression functions manual investigation of differential addition and doubling formulas is very difficult, we came up with a Magma program which relies on the Gr\"obner basis. We prove that if for a model $E$ of an elliptic curve exists an isomorphism $\phi:E \to E_M$, where $E_M$ is the Montgomery curve and for any $P \in E(\mathbb K)$ holds that $\phi(P)=(\phi_x(P), \phi_y(P))$, then for a model $E$ one may find compression function of degree $2$. Moreover, one may find, defined for this compression function, differential addition and doubling formulas of the same efficiency as Montgomery's. However, it seems that for the family of elliptic curves having a natural point of order $3$, compression functions of the same efficiency do not exist.